1290 matches found
Security update for grub2
This update for grub2 fixes the following issues: CVE-2024-56738: Side-channel attack due to not constant-timealgorithm in grubcryptomemcmp bsc1234959. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat
...
Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write
...
Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution
...
Grub2: fs/tar: integer overflow causes heap oob write
...
Grub2: read: integer overflow may lead to out-of-bounds write
...
Grub2: fs/hfs+: refcount can be decremented twice
...
Grub2: commands/extcmd: missing check for failed allocation
...
Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.
...
Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks
...
Grub2: grub-core/gettext: integer overflow leads to heap oob write.
...
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.
...
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
...
Linux Distros Unpatched Vulnerability : CVE-2020-14309
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size...
Linux Distros Unpatched Vulnerability : CVE-2024-2312
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to ...
Linux Distros Unpatched Vulnerability : CVE-2024-23301
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Relax-and-Recover aka ReaR through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain access to system secrets...
Linux Distros Unpatched Vulnerability : CVE-2022-28734
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one...
Linux Distros Unpatched Vulnerability : CVE-2022-28736
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There's a use-after-free vulnerability in grubcmdchainloader function; The chainloader command is used to boot up operating systems that doesn't support multibo...
Linux Distros Unpatched Vulnerability : CVE-2021-3696
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space...
Linux Distros Unpatched Vulnerability : CVE-2022-28733
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer underflow in grubnetrecvip4packets; A malicious crafted IP packet can lead to an integer underflow in grubnetrecvip4packets function on rsm-totallen...